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AMENDMENTS TO THE CLAIMS: 

Please amend claims 1, 6-8, 19, 24-26, 37 and 42-44 and add newly written claims 55-57 
as follows. 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1. (currently amended) A computer program product comprising a computer program 
operable to control a computer to generate audit data indicative of a request to execute a 
computer program, said computer program comprising: 

(i) computer virus scanner logic , responsive to operable to receive a computer virus 
scan request , said computer virus scan request including data identifying a computer file to be 
scanned for computer viruses , for performing a computer virus scan and for generating a scan 
result ; and 

(ii) audit data generator logic triggered by said computer virus scanner logic, and 
responsive to said data identifying said computer file to be scanned, to identify for identifying a 
request to execute a computer program and, in response to identification of said request to 
execute said computer program, to generate for generating audit data identifying said computer 
program. 

2. (original) A computer program product as claimed in claim 1, wherein a file access 
request to an operating system triggers generation of said computer virus scan request. 
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3. (original) A computer program product as claimed in claim 1, wherein said audit data 
generator logic is responsive to data identifying one or more banned computer programs to 
identify a request to execute a banned computer program. 

4. (original) A computer program product as claimed in claim 3, wherein, if a request to 
execute a banned computer program is identified, then one or more banned program actions are 
triggered, said banned program actions including one or more of: 

(i) said banned computer program is deleted; 

(ii) said banned computer program is disabled; 

(iii) said banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

5. (original) A computer program product as claimed in claim 3, wherein said data 
identifying one or more banned computer programs is a permitted computer program list with 
any computer program not included within said permitted computer program list being a banned 
computer program. 

6. (currently amended) A computer program product as claimed in claim 1, further 
comprising concurrent usage logic operable to p e rfcrm for performing: a concurrent usage check 
to identify for identifying a request to execute a further computer program that would result in 
said further computer program concurrently executing upon more than a predetermined number 
of computers upon a computer network. 
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7. (currently amended) A computer program product as claimed in claim 6, wherein, if 
said concurrent usage check indicates that said request to execute said further computer program 
would result in more than said predetermined number of computers upon said computer network 
concurrently executing said computer program, then said request to execute said further 
computer program is denied. 

8. (currently amended) A computer program product as claimed in claim 7, wherein a 
user message is displayed when execution of said further computer program is prevented. 

9. (original) A computer program product as claimed in claim 6, wherein said 
predetermined number varies with time. 

10. (original) A computer program product as claimed in claim 9, wherein at certain 
times said predetermined number is zero. 

11. (original) A computer program product as claimed in claim 1, wherein said audit data 
generator logic calculates a checksum value from said computer file, said checksum value being 
used in identification of said computer file as a particular computer program. 

12. (original) A computer program product as claimed in claim 11, wherein said audit 
data generator logic stores said calculated checksum value and uses said stored calculated 
checksum values instead of recalculating said checksum value when said computer file subject to 
a subsequent access without any intervening change having been made to said computer file. 
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13. (original) A computer program product as claimed in claim 1, wherein said audit data 
generator logic is responsive to a non-user specified database of data indicative of particular 
computer programs. 

14. (original) A computer program product as claimed in claim 1, wherein said audit data 
generator logic is responsive to a user specified database of data indicative of particular 
computer programs. 

15. (original) A computer program product as claimed in claim 1, wherein said computer 
virus scan request results from an on-access scan. 

16. (original) A computer program product as claimed in claim 1, wherein said computer 
virus scan request results from an on-demand scan. 

17. (original) A computer program product as claimed in claim 1, wherein local audit 
data is stored upon a computer within a computer network until said computer is polled by a 
remote computer upon said computer network whereupon said local audit data is sent to said 
remote computer. 

18. (original) A computer program product as claimed in claim 17, wherein said remote 
computer generates a consolidated audit report for a plurality of computers upon said computer 
network. 
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19. (currently amended) A method of generating audit data indicative of a request to 
execute a computer program, said method comprising the steps of: 

(i) responsive to receiving a computer virus scan request within a computer virus 
scanner, performing a computer virus scan and generating a scan result, said computer virus scan 
request including data identifying a computer file to be scanned for computer viruses; 

(ii) triggering operation of an audit data generator using said computer virus scanner, 
said audit data generator being responsive to said data identifying said computer file to be 
scanned to identify a request to execute a computer program; and 

(iii) in response to identification of said request to execute said computer program, 
generating audit data identifying said computer program. 

20. (original) A method as claimed in claim 19, wherein a file access request to an 
operating system triggers generation of said computer virus scan request. 

21. (original) A method as claimed in claim 19, wherein said audit data generator is 
responsive to data identifying one or more banned computer programs to identify a request to 
execute a banned computer program. 

22. (original) A method as claimed in claim 21, wherein, if a request to execute a banned 
computer program is identified, then one or more banned program actions are triggered, said 
banned program actions including one or more of: 

(i) said banned computer program is deleted; 
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(ii) said banned computer program is disabled; 

(iii) said banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

23. (original) A method as claimed in claim 21, wherein said data identifying one or more 
banned computer programs is a permitted computer program list with any computer program not 
included within said permitted computer program list being a banned computer program. 

24. (currently amended) A method as claimed in claim 19, further comprising the step of 
performing a concurrent usage check to identify for identifying a request to execute a further 
computer program that would result in said further computer program concurrently executing 
upon more than a predetermined number of computers upon a computer network. 

25. (currently amended) A method as claimed in claim 24, wherein, if said concurrent 
usage check indicates that said request to execute said further computer program would result in 
more than said predetermined number of computers upon said computer network concurrently 
executing said further computer program, then said request to execute said further computer 
program is denied. 

26. (currently amended) A method as claimed in claim 25, wherein a user message is 
displayed when execution of said further computer program is prevented. 
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27. (original) A method as claimed in claim 24, wherein said predetermined number 
varies with time. 

28. (original) A method as claimed in claim 27, wherein at certain times said 
predetermined number is zero. 

29. (original) A method as claimed in claim 19, wherein said audit data generator 
calculates a checksum value from said computer file, said checksum value being used in 
identification of said computer file as a particular computer program. 

30. (original) A method as claimed in claim 29, wherein said audit data generator stores 
said calculated checksum value and uses said stored calculated checksum values instead of 
recalculating said checksum value when said computer file subject to a subsequent access 
without any intervening change having been made to said computer file. 

31. (original) A method as claimed in claim 19, wherein said audit data generator is 
responsive to a non-user specified database of data indicative of particular computer programs. 

32. (original) A method as claimed in claim 19, wherein said audit data generator is 
responsive to a user specified database of data indicative of particular computer programs. 

33. (original) A method as claimed in claim 19, wherein said computer virus scan request 
results from an on-access scan. 
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34. (original) A method as claimed in claim 19, wherein said computer virus scan request 
results from an on-demand scan. 

35. (original) A method as claimed in claim 19, wherein local audit data is stored upon a 
computer within a computer network until said computer is polled by a remote computer upon 
said computer network whereupon said local audit data is sent to said remote computer. 

36. (original) A method as claimed in claim 35, wherein said remote computer generates 
a consolidated audit report for a plurality of computers upon said computer network. 

37. (currently amended) Apparatus for generating audit data indicative of a request to 
execute a computer program, said apparatus comprising: 

(i) a computer virus scanner , responsive to operable to receive a computer virus scan 
request, for performing a computer virus scan and for generating a scan result, said computer 
virus scan request including data identifying a computer file to be scanned for computer viruses; 
and 

(ii) an audit data generator triggered by said computer virus scanner logic, and 
responsive to said data identifying said computer file to be scanned, to identify for identifying a 
request to execute a computer program and, in response to identification of said request to 
execute said computer program, to generate for generating audit data identifying said computer 
program. 



-9- 



959513 



TARBOTTON et al 
Appl. No. 09/785,222 
June 2, 2005 

38. (original) Apparatus as claimed in claim 37, wherein a file access request to an 
operating system triggers generation of said computer virus scan request. 

39. (original) Apparatus as claimed in claim 37, wherein said audit data generator is 
responsive to data identifying one or more banned computer programs to identify a request to 
execute a banned computer program. 

40. (original) Apparatus as claimed in claim 39, wherein, if a request to execute a banned 
computer program is identified, then one or more banned program actions are triggered, said 
banned program actions including one or more of: 

(i) said banned computer program is deleted; 

(ii) said banned computer program is disabled; 

(iii) said banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

41. (original) Apparatus as claimed in claim 39, wherein said data identifying one or 
more banned computer programs is a permitted computer program list with any computer 
program not included within said permitted computer program list being a banned computer 
program. 

42. (currently amended) Apparatus as claimed in claim 37, further comprising a 
concurrent usage monitor operable to p e rform for performing a concurrent usage check te 
idetttify for identifying a request to execute a further computer program that would result in said 
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further computer program concurrently executing upon more than a predetermined number of 
computers upon a computer network. 

43. (currently amended) Apparatus as claimed in claim 42, wherein, if said concurrent 
usage check indicates that said request to execute said further computer program would result in 
more than said predetermined number of computers upon said computer network concurrently 
executing said further computer program, then said request to execute said further computer 
program is denied. 

44. (currently amended) Apparatus as claimed in claim 43, wherein a user message is 
displayed when execution of said further computer program is prevented. 

45. (original) Apparatus as claimed in claim 42, wherein said predetermined number 
varies with time. 

46. (original) Apparatus as claimed in claim 45, wherein at certain times said 
predetermined number is zero. 

47. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
calculates a checksum value from said computer file, said checksum value being used in 
identification of said computer file as a particular computer program. 
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48. (original) Apparatus as claimed in claim 47, wherein said audit data generator stores 
said calculated checksum value and uses said stored calculated checksum values instead of 
recalculating said checksum value when said computer file subject to a subsequent access 
without any intervening change having been made to said computer file. 

49. (original) Apparatus as claimed in claim 37, wherein said audit data generator is 
responsive to a non-user specified database of data indicative of particular computer programs. 

50. (original) Apparatus as claimed in claim 37, wherein said audit data generator is 
responsive to a user specified database of data indicative of particular computer programs. 

51. (original) Apparatus as claimed in claim 37, wherein said computer virus scan request 
results from an on-access scan. 

52. (original) Apparatus as claimed in claim 37, wherein said computer virus scan request 
results from an on-demand scan. 

53. (original) Apparatus as claimed in claim 37, wherein local audit data is stored upon a 
computer within a computer network until said computer is polled by a remote computer upon 
said computer network whereupon said local audit data is sent to said remote computer. 

54. (original) Apparatus as claimed in claim 53, wherein said remote computer generates 
a consolidated audit report for a plurality of computers upon said computer network.. 
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55. (new) A computer program product comprising a computer program operable to 
control a computer to generate audit data indicative of a request to execute a computer program, 
said computer program comprising: 

(i) computer virus scanner logic, responsive to a computer virus scan request 
including data identifying a computer file to be scanned for computer viruses, for performing a 
computer virus scan and for generating a scan result; 

(ii) audit data generator logic triggered by said computer virus scanner logic, and 
responsive to said data identifying said computer file to be scanned, for identifying a request to 
execute a computer program and, in response to identification of said request to execute said 
computer program, for generating audit data identifying said computer program; and 

(iii) concurrent usage logic for performing a concurrent usage check for identifying a 
request to execute a further computer program that would result in said further computer 
program concurrently executing upon more than a predetermined number of computers upon a 
computer network. 

56. (new) A method of generating audit data indicative of a request to execute a computer 
program, said method comprising the steps of: 

(i) responsive to a computer virus scan request within a computer virus scanner, 
performing a computer virus scan and generating a scan result, said computer virus scan request 
including data identifying a computer file to be scanned for computer viruses; 
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(ii) triggering operation of an audit data generator using said computer virus scanner, 
said audit data generator being responsive to said data identifying said computer file to be 
scanned to identify a request to execute a computer program; 

(iii) in response to identification of said request to execute said computer program, 
generating audit data identifying said computer program; and 

(iv) performing a concurrent usage check for identifying a request to execute a further 
computer program that would result in said further computer program concurrently executing 
upon more than a predetermined number of computers upon a computer network. 

57. (new) Apparatus for generating audit data indicative of a request to execute a 
computer program, said apparatus comprising: 

(i) a computer virus scanner, responsive to a computer virus scan request, for performing 
a computer virus scan and for generating a scan result, said computer virus scan request 
including data identifying a computer file to be scanned for computer viruses; 

(ii) an audit data generator triggered by said computer virus scanner logic, and responsive 
to said data identifying said computer file to be scanned, for identifying a request to execute a 
computer program and, in response to identification of said request to execute said computer 
program, for generating audit data identifying said computer program; and 

(iii) a concurrent usage monitor for performing a concurrent usage check for identifying a 
request to execute a further computer program that would result in said further computer 
program concurrently executing upon more than a predetermined number of computers upon a 
computer network. 
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